First published: Tue Jan 26 2021(Updated: )
IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Credit: psirt@us.ibm.com
Affected Software | Affected Version | How to fix |
---|---|---|
Ibm Collaborative Lifecycle Management | =6.0.2 | |
Ibm Collaborative Lifecycle Management | =6.0.6 | |
Ibm Collaborative Lifecycle Management | =6.0.6.1 | |
IBM ENI | =7.0 | |
IBM Engineering Lifecycle Management | =7.0 | |
IBM Engineering Requirements Management DOORS Next | =6.0.2 | |
IBM Engineering Requirements Management DOORS Next | =6.0.6 | |
IBM Engineering Requirements Management DOORS Next | =6.0.6.1 | |
IBM Engineering Requirements Management DOORS Next | =7.0 | |
IBM Engineering Test Management | =7.0.0 | |
IBM Engineering Workflow Management | =6.0.2 | |
IBM Engineering Workflow Management | =6.0.6 | |
IBM Engineering Workflow Management | =6.0.6.1 | |
IBM Engineering Workflow Management | =7.0 | |
IBM Engineering Workflow Management | =7.0.2 | |
IBM Global Configuration Management | ||
IBM Rational Engineering Lifecycle Manager | =6.0.2 | |
IBM Rational Engineering Lifecycle Manager | =6.0.6 | |
IBM Rational Engineering Lifecycle Manager | =6.0.6.1 | |
IBM Rational Quality Manager | =6.0.2 | |
IBM Rational Quality Manager | =6.0.6 | |
IBM Rational Quality Manager | =6.0.6.1 | |
Ibm Rhapsody Design Manager | =6.0.2 | |
Ibm Rhapsody Design Manager | =6.0.6 | |
Ibm Rhapsody Design Manager | =6.0.6.1 | |
Ibm Rhapsody Design Manager | =7.0 | |
IBM Rhapsody Model Manager | =6.0.2 | |
IBM Rhapsody Model Manager | =6.0.6 | |
IBM Rhapsody Model Manager | =6.0.6.1 | |
IBM Rhapsody Model Manager | =7.0 | |
<=7.0.2 | ||
<=6.0.2 | ||
<=6.0.6.1 | ||
<=7.0 | ||
<=6.0.6 | ||
<=6.0.2 | ||
<=7.0 | ||
<=6.0.6.1 | ||
<=6.0.6 | ||
<=6.0.6 | ||
<=6.0.6.1 | ||
<=6.0.2 | ||
<=7.0 | ||
<=6.0.6.1 | ||
<=6.0.6 | ||
<=7.0 | ||
<=6.0.2 | ||
<=6.0.6.1 | ||
<=6.0.6 | ||
<=7.0 | ||
<=6.0.2 | ||
<=6.0.6.1 | ||
<=6.0.6 | ||
<=7.0.0 | ||
<=6.0.2 | ||
<=6.0.6.1 | ||
<=6.0.6 | ||
<=7.0 | ||
<=6.0.2 | ||
<=All |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2021-20357 is a vulnerability in IBM Global Configuration Management that allows for cross-site scripting.
The severity level of CVE-2021-20357 is medium with a CVSS score of 5.4.
IBM Engineering Workflow Management (EWM) versions 7.0.2 and below, IBM Rational Team Concert (RTC) versions 6.0.2, 6.0.6, and 6.0.6.1, IBM Requirements Management DOORS Next (RDNG) versions 6.0.2, 6.0.6, and 6.0.6.1, and IBM Global Configuration Management are affected by CVE-2021-20357.
CVE-2021-20357 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
Apply the necessary security patches provided by IBM for the affected products to mitigate the CVE-2021-20357 vulnerability.